summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* ip6tables-translate: Fix libip6t_mh.txlate testPhil Sutter2018-08-241-2/+2
| | | | | | | | | Layer 4 protocol name "mobility-header" is not known by nft, so it's neither printed nor accepted on input. Hence fix the test instead of code. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-translate: Fix for libebt_limit.txlatePhil Sutter2018-08-241-1/+9
| | | | | | | | | The xlate function sharing here does not quite work since in ebtables-translate, extensions are supposed to append whitespace. Fix this by introducing a simple wrapper. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Add missing deinitializationPhil Sutter2018-08-243-5/+8
| | | | | | | | | | These fix reports for definitely lost blocks in valgrind. Not really memleaks, but due to nft_handle going out of scope they're counted as lost. Still worth fixing though since it reduces noise when auditing code for real issues. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Review match/target lookup once morePhil Sutter2018-08-244-165/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a partial revert of my previous commit with similar subject - it missed to apply the needed changes to ebtables-translate as well and on top of that still left some leaks and use-after-frees in place. The new strategy is to make ebtables extension loading compatible with that of xtables, because otherwise the heavy code sharing between ebtables-translate and iptables-translate will cause trouble. Basically, ebt_add_match() and ebt_add_watcher() copy what xtables' command_match() does, but after the actual extension argument parsing has already happened. Therefore they duplicate the loaded match along with its data and reset the original one to default state for being reused (e.g., by ebtables-restore). Since mflags/tflags are cleared while doing so, clearing them for all loaded extensions in do_commandeb() is not necessary anymore. In ebt_command_default() (where extension parameter parsing happens), the list of added extensions to the current rule are consolidated first so no duplicate extension loading happens. With the above in place, ebt_cs_clean() can be reverted to its old state. Apart from sharing command_jump() function with ebtables-translate, make use of nft_init_eb() there, as well. Fixes: aa7fb04fcf72c ("ebtables: Review match/target lookup") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: libebt_mark: Drop mark_supplied checkPhil Sutter2018-08-241-7/+0
| | | | | | | | | | | | | | | | Use of this static variable causes trouble as it affects all instances of this target. So calling xs_init_target() for one instance invalidates all the others. Moving the variable into target private data seems not possible since that would change the target's size and therefore it wouldn't match anymore with what kernel expects. So just get rid of it entirely. If a user "forgets" to set a mark value, the default value of zero applies. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Add a few missing exit callsPhil Sutter2018-08-242-2/+7
| | | | | | | | | Mostly to reduce noise from valgrind output, add missing calls to destroy iterators in nft.c and add cleanup for the populated nft_handle in xtables_eb_save_main(). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables-translate: Fix segfault while parsing extension optionsPhil Sutter2018-08-243-73/+47
| | | | | | | | | | | | | | | Previous review of match/target lookup did not consider xtables-eb-translate.c which contains the same code. Fix parsing of target/match arguments there as well by introducing ebt_command_default() which consolidates the previously duplicated code. One notable quirk in comparison to the similar xtables code: Since ebtables allows for negations in ugly places (e.g. '--arp-opcode ! 1'), ebt_check_inverse2() has to be called first. Fixes: aa7fb04fcf72c ("ebtables: Review match/target lookup") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: trivial: Leverage C99-style initializers a bit morePhil Sutter2018-08-241-1/+1
| | | | | | | | | | This nit was discovered when comparing do_commandeb() with do_commandeb_xlate(): Since 'cs' is initialized upon declaration already, initialization of field '.eb.bitmask' may be moved there as well. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xlate-test: Fix for calling wrong command namePhil Sutter2018-08-241-1/+1
| | | | | | | | | Aparently, this is a leftover from the compat->nft naming change in created binary (symlinks). Fixes: be70918eab26e ("xtables: rename xt-multi binaries to -nft, -legacy") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extensions: AUDIT: Provide translationPhil Sutter2018-08-242-0/+19
| | | | | | | | | With audit logging being supported by nftables as a simple (fake) log level, translating AUDIT target is easy. Especially since xt_AUDIT in kernel doesn't quite care about --type parameter. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Use meta l4proto for -p matchPhil Sutter2018-08-214-4/+9
| | | | | | | | | | | | | | | Use of payload expression to match against IPv6 nexthdr field does not work if extension headers are present. A simple example for that is matching for fragmented icmpv6 traffic. Instead, generate a 'meta l4proto' expression which works even if extension headers are present. For consistency, apply the same change to iptables-nft as well. No adjustment to reverse path required as the needed bits were added by commit 6ea7579e6fe24 ("nft: decode meta l4proto") already. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for segfault when registering hashlimit extensionHeena Sirwani2018-08-211-0/+1
| | | | | | | | | | | | This patch fixes the crash when registering the hashlimit extension with xtables during init_extensions(when built with static libs) . The option validation function xtables_option_metavalidate has a loop termination condition of the entry name being NULL. The loop does not terminate when validating hashlimit_mt_opts_v2 which causes a crash on derefencing an invalid entry. Signed-off-by: Heena Sirwani <heenasirwani@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for segfault in iptables-nftPhil Sutter2018-08-172-5/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Trying to set a chain's policy in an invalid table resulted in a segfault. Reproducer was: | # iptables -t broute -P BROUTING ACCEPT Fix this by aborting in nft_chain_new() if nft_table_builtin_find() returned NULL for the given table name. For an illustrative error message, set errno to ENXIO in the above case and add an appropriate Mesage to nft_strerror(). While being at it, improve the error message if an invalid policy was given. Before: | # iptables-nft -t filter -P INPUT ACCEPTdf | iptables: Incompatible with this kernel. After: | # iptables-nft -t filter -P INPUT ACCEPTdf | iptables: Bad policy name. Run `dmesg' for more information. Third unrelated change in this patch: Drop error checking of nft_chain_set() in do_commandx(): The function never returns negative, so that check never yielded true. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Fix entries count in chain listingPhil Sutter2018-08-166-9/+40
| | | | | | | | | | | | | | | The previous fix for reference counts in iptables-nft output wasn't complete: While iptables lists the number of references for each custom chain (i.e., the number of jumps to it), ebtables lists number of entries (i.e., the number of rules contained) for each chain. Both used the same value for it, although they are different metrics. Fix this by passing both numbers separately to the 'print_header' callback so that each tool may print the desired value. Fixes: a0698de9866d2 ("xtables: Do not count rules as chain references") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Make 'iptables -S nonexisting' return non-zeroPhil Sutter2018-08-164-15/+86
| | | | | | | | | | | | To be consistent with legacy iptables, calling -S with a non-existing chain should lead to an error message. This is how some scripts find out whether a user-defined chain exists or not. Make sure doing the same for an existing chain does succeed, even if an invalid rule number was given. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Fix for listing of non-existent chainsPhil Sutter2018-08-162-5/+7
| | | | | | | | | | | | | | | | | When trying to list a non-existent chain, ebtables-nft would just print the table header and then exit with a code of zero. In order to be more consistent with legacy ebtables, change the code to: * Print table header only if chosen chain is found and * propagate the error condition if chain was not found to print an error message. Note that this does not establish full parity with legacy ebtables due to the error code being 1 instead of 255 and the error message differing from the legacy one. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Fix for no output in iptables-nft -SPhil Sutter2018-08-161-0/+17
| | | | | | | | | | | Just like with 'iptables-nft -L', we have to make sure the standard set of chains exist for a given table when listing it using '-S' flag. The added code was just copied over from nft_rule_list() which does the same. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* arptables: Drop extensions/libxt_mangle.cPhil Sutter2018-08-161-396/+0
| | | | | | | This was merely an outdated duplicate of extensions/libarpt_mangle.c. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Merge libebt_limit.c into libxt_limit.cPhil Sutter2018-08-165-225/+97
| | | | | | | | | | | | | | | | | Both extensions were very similar already, but now that they both are translated into native nftables code, their actual difference (i.e. match size) doesn't matter anymore. This change comes with one caveat: Since ebtables limit match is not in its own file anymore, match preloading automatically also loads the NFPROTO_UNSPEC limit match. This is not a problem per se since match lookup will prefer the family-specific one, but when parsing unknown options, a match without 'parse' callback is encountered. Therefore do_commandeb() has to check existence of that callback prior to dereferencing it. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* xtables: Use native nftables limit expressionPhil Sutter2018-08-162-4/+95
| | | | | | | | | | | | | | | | | | | | The original issue was that for a rule with limit match added by ebtables-nft, the kernel might attempt to use xt_limit instead of ebt_limit (and fail due to that). This happens if xt_limit.ko is loaded but ebt_limit.ko is not, because the kernel prefers the family-independent variants. There are multiple ways to avoid above issue, but using neither xt_limit nor ebt_limit with nft-variants should be the most effective one. Therefore translate a created limit match in userspace into native nftables code before sending it to kernel and do the reverse translation when listing rules. Apart from the translation routines, this requires slight adjustment of nft_is_expr_compatible() since neither xt_limit nor ebt_limit support byte-based limits or inverted limit match. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ebtables: Remove flags misinterpretationsPhil Sutter2018-08-101-9/+7
| | | | | | | | | | | | | | | This is actually quite a mess: xtables-eb.c defines names for bits in 'flags' variable of do_commandeb(), though these tend to clash with bit names defined in xshared.h due to the same 'OPT_' prefix. Therefore checking for bits OPT_NUMERIC and OPT_VERBOSE is syntactically correct, but semantically wrong as they actually refer to bits OPT_COMMAND and OPT_PROTOCOL. Since ebtables doesn't support numeric nor verbose modes, just replace the checks with zero values. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for wrong counter format in -S outputPhil Sutter2018-08-097-32/+83
| | | | | | | | | | | | | | | | | | | | | | Legacy iptables uses '-c PCNT BCNT' format in listed rules, nft-variant used '[PCNT BCNT]' prefix like with iptables-save. In order to pass the counter format preference along, FMT_C_COUNTS is introduced and related 'format' checks adjusted. Since legacy iptables prints the counters between matches and target, this change affects save_matches_and_target() function. In order to get access to the rule counters, it's declaration is adjusted to receive iptables_command_state pointer instead of match, target and jumpto pointers from the same object. While being at it, integrate jump to user-defined chain into it as well since the related code in both callers was almost identical. Though since different rule flags are used between iptables and ip6tables, pass a 'goto_flag' boolean instead of the actual 'flags' bitfield. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Don't pass full invflags to add_compat()Phil Sutter2018-08-094-3/+13
| | | | | | | | | | | The function expects a boolean, not a bitfield. This bug caused inversion in another match to carry over to protocol match by accident. The supplied testcase contains rules which then fail because they contain matches requiring that protocol. Fixes: 4ef77b6d1b52e ("xtables: fix missing protocol and invflags") Fixes: 4143a08819a07 ("ebtables-compat: add nft rule compat information to bridge rules") Signed-off-by: Phil Sutter <phil@nwl.cc>
* xtables: Improve xtables-monitor first impressionPhil Sutter2018-08-091-1/+2
| | | | | | | | | | | | | First time users are likely to call 'xtables-monitor --help' to see what's going on. Make this situation a bit more pleasant for them: * When complaining about illegal arguments, add a final newline character to the error message. * Actually support '--help' long option as an alias to '-h'. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: Fix skipping for recent nft-only testsPhil Sutter2018-08-094-4/+4
| | | | | | | | | | | | | | | In an attempt to sanitize shell scripting, exit test in recent testcases was altered, which led to them being skipped even in nft test runs. Drop the quotes so that globbing happens again. While here, improve the check a bit to glob only on leading path part, not also the file name. Also print "skip ..." just like nft-only/0001compat_0 testcase does. Fixes: f1d8508fd6fdc ("tests: Add arptables-{save,restore} testcases") Fixes: fbf0bf7c079d8 ("tests: Add ebtables-{save,restore} testcases") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Spelling fixes in xtables-monitorPhil Sutter2018-08-072-7/+7
| | | | | | | | | Fix a few minor spelling issues in xtables-monitor help output and man page. While being at it, change 'ipv4' and 'ipv6' to 'IPv4' and 'IPv6', respectively. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix potential segfault in nft_rule_append()Phil Sutter2018-08-061-1/+3
| | | | | | | | | If batch_rule_add() failed (ENOMEM), nft_rule_append() frees the rule and then tries to add it to the rule cache. Better return 0 (failure) instead of continuing. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: Add ebtables-{save,restore} testcasesPhil Sutter2018-08-062-0/+145
| | | | | | | | | | | This actually does a bit more since it creates the ruleset using separate ebtables calls. Note that there are a few commented out lines containing commands which don't apply for unknown reasons - something to investigate later. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* tests: Add arptables-{save,restore} testcasesPhil Sutter2018-08-062-0/+86
| | | | | | | | | | | This actually does a bit more since it creates the ruleset using separate arptables calls. Note that there are a few commented out lines containing commands which don't apply for unknown reasons - something to investigate later. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Implement arptables-{save,restore}Phil Sutter2018-08-069-43/+146
| | | | | | | | | | | This adds C implementations for arptables-save and -restore in compat layer based on the two perl scripts in legacy arptables repository. To share common code, introduce nft_init_arp() analogous to nft_init_eb() introduced earlier. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Review match/target lookupPhil Sutter2018-08-062-42/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since ebtables does not indicate extension use on commandline via '-m' flag as in iptables, loading of matches has to happen prior to commandline parsing. While parsing, the right extension is searched for unknown parameters by passing it to its 'parse' callback and checking if it succeeds. As an unavoidable side-effect, custom data in xtables_targets objects is being altered if the extension parser succeeds. If called multiple times, do_commandeb() leaks memory and fixing this requires to properly treat the above quirk: * Load extensions just once at program startup, thereby reusing the existing ones for several calls of do_commandeb(). * In ebt_cs_clean(), don't free memory which is being reused. Instead reinit custom extension data if it was used in current do_commandeb() call (i.e., it is contained in cs->match_list). On the other hand, target lookup in command_jump() can be simplified a lot: The only target it may have loaded is 'standard', so just load that at as well at program startup and reduce command_jump() to a simple linked list search. Since 'standard' target does not prove a 'parse' callback, a check is necessary when parsing target options. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables-restore: Use xtables_restore_parse()Phil Sutter2018-08-064-89/+24
| | | | | | | | | This drops the dedicated input parser (which was broken in many ways anyway) and replaces it by the common one now that all required knobs are in place. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-restore: Make COMMIT support configurablePhil Sutter2018-08-062-3/+9
| | | | | | | | | | | | | | Legacy ebtables-restore does not support COMMIT directive, so allow for callers of xtables_restore_parse() to toggle whether it is required or not. In iptables, omitting COMMIT may be used for syntax checking, so we must not add an implicit commit at EOF. Although ebtables/arptables legacy does not support COMMIT lines at all, this patch allows them in nft variants. If omitted, an implicit commit happens for them at EOF. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables-restore: Improve user-defined chain detectionPhil Sutter2018-08-063-13/+21
| | | | | | | | | | | | Legacy ebtables-save does not use a policy string of '-' to denote user-defined chains but instead lists them with a policy of ACCEPT. In order to use ebtables_restore_parse() for ebtables-save implementation, make use of builtin table definitions to decide whether a given chain is a builtin one or not. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Match verbose ip{,6}tables output with legacyPhil Sutter2018-08-047-25/+157
| | | | | | | | | | | | | | Legacy ip{,6}tables prints feedback for various commands if in verbose mode, make sure nft variants do the same. There is one difference, namely when checking a rule (-C command): Legacy ip{,6}tables print the rule in any case, nft variants don't in case the rule wasn't found. Changing this though would require to populate the nftnl_rule object just for printing, which is probably not feasible. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Reserve space for 'opt' column in ip6tables outputPhil Sutter2018-08-041-0/+5
| | | | | | | | | Although ip6tables does not support matching on fragments, the 'opt' column is included in ruleset listing nevertheless. So nft_ipv6_print_rule() has to fill that space up with blanks. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Print error when listing non-existent chainsPhil Sutter2018-08-041-2/+5
| | | | | | | | Just like legacy iptables, iptables-nft should not treat the attempt to list a non-existing chain as OK. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix for no output on first iptables-nft invocationPhil Sutter2018-08-041-1/+3
| | | | | | | | | | | | Fix the same issue commit a4e78370af849 ("iptables-compat: fix empty chains after first invocation of iptables-compat -L") fixed back in 2014. Seems like some changes since then broke it again. This time, existing cache not containing the added table/chains gets into the way, so clear it if nft_commit() was called. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Do not count rules as chain referencesPhil Sutter2018-08-042-0/+52
| | | | | | | | | | Unlike iptables, nftables counts rules in a chain as references to that chain. Align output of 'iptables-nft -L' with that of legacy iptables by counting the number of rules in a chain and subtracting that value from reference count before printing the chain header. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Fix jumps into user-defined chainsPhil Sutter2018-08-041-11/+0
| | | | | | | | | | | | | | | Trying to jump into a user-defined chain was not possible: | arptables-nft -N foo | arptables-nft -A INPUT -j foo | (null) v1.8.0 (nf_tables): RULE_APPEND failed (No such file or directory): rule in chain INPUT Since nft_arp_add() already does the right thing if cs->target is NULL and cs->jumpto contains a non-empty string, simply drop the block of code trying to deal with the situation. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Fix opcode printing in numeric outputPhil Sutter2018-08-041-0/+1
| | | | | | | | This line of code was dropped by accident, add it back. Fixes: 68e5e18210b8d ("nft-arp: adds nft_arp_save_firewall") Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xtables: Fix symlinks/names for ebtables-{save, restore}Phil Sutter2018-08-042-2/+5
| | | | | | | | | | While xtables-nft-multi only recognized ebtables-save and -restore, Makefile did install only ebtables-nft-save and -restore symlinks. Clean this up by making both name variants known and installing respective symlinks, just like for ebtables and ebtables-nft. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Support --init-table commandPhil Sutter2018-08-041-1/+3
| | | | | | | | | This effectively flushes all built-in chains and removes user-defined ones. Since compat layer takes care of built-in table/chain creation, it is sufficient to just drop the relevant table. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Print policy only for base chainsPhil Sutter2018-08-041-1/+1
| | | | | | | Printing a policy for user-defined chains is pointless. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Fix for trailing spaces in outputPhil Sutter2018-08-041-24/+16
| | | | | | | | | | | | This changes mangle target to print whitespace before each option, not afterwards. This fixes any cases of trailing or double whitespace in arptables output. While being at it, introduce ipaddr_to() helper in libarpt_mangle.c to simplify arpmangle_print() a bit. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* arptables: Fix memleaks in do_commandarp()Phil Sutter2018-08-041-7/+12
| | | | | | | | | The function did not free memory allocated in parse_hostnetworkmask() and command_jump(). To fix the latter, code was aligned a bit more with xtables.c (especially opts handling). Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Print non-standard target parametersPhil Sutter2018-08-041-1/+3
| | | | | | | | | | | | | | | If a rule has a non-standard target (i.e., cs->target != NULL), it may contain parameters. This patch enables printing them. The code assumed that a non-standard target is only present if cs->jumpto is not set, but that is wrong: If nft_rule_to_iptables_command_state() encounters a target expression, it calls nft_parse_target() which in turn calls the family-specific parse_target callback. All of them assign cs->target, whose name is later assigned to cs->jumpto by the first function. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Fix match_list insertionPhil Sutter2018-08-041-10/+8
| | | | | | | | Find the end of the match_list before inserting in case the list contains more than one element. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* ebtables: Fix for wrong program name in error messagesPhil Sutter2018-08-044-5/+5
| | | | | | | | Since nft_init_eb() is shared among standalone ebtables and ebtables-restore, allow for callers to pass the program name. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* xshared: Consolidate argv construction routinesPhil Sutter2018-08-046-374/+161
| | | | | | | | | | | | | | | | | | | | | Implementations were equal in {ip,ip6,x}tables-restore.c. The one in iptables-xml.c differed slightly. For now, collect all features together. Maybe it would make sense to migrate iptables-xml.c to using add_param_to_argv() at some point and therefore extend the latter to store whether a given parameter was quoted or not. While being at it, a few improvements were done: * free_argv() now also resets 'newargc' variable, so users don't have to do that anymore. * Indenting level in add_param_to_argv() was reduced a bit. * That long error message is put into a single line to aid in grepping for it. * Explicit call to exit() after xtables_error() is removed since the latter does not return anyway. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>